[Bro] high cpu usage and strange select(2) behavior

[Seth Hall]

On Feb 10, 2012, at 11:05 AM, Stephane Chazelas wrote:

> I think we're onto something here. node.cfg has "standalone" and
> yet the cpu load is high. Where should I be looking? (I have to
> admit I'm quite new to bro).
> # Automatically generated. Do not edit.
> redef Communication::listen_port = 47760/tcp;
> redef Communication::nodes += {
>        ["control"] = [$host=127.0.0.1, $class="control", $events=Control::controller_events],
> };


Oops!  I completely forgot that the communications framework is always enabled when you use BroControl so that the control framework is available.  It makes it possible to communicate with and control Bro at runtime through broctl.

There aren't any knobs to disable that at the moment since BroControl's functionality would be sporadically broken without it.  I've been bugging Robin about the high cpu load with the communications framework enabled and low traffic for quite a few years but you can actually compensate for it quite a bit now by increasing the timeout values that you were writing about before.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/